HIPAA Digital Marketing Guide for Therapists

How to Use This Guide

Mental health practices carry some of the heaviest privacy obligations in healthcare marketing. Even saying that someone is your client can disclose protected health information (PHI). Four layers of rules apply at once:

1. Federal HIPAA: the Privacy Rule, Security Rule, and Breach Notification Rule.
2. Federal consumer-protection law: the FTC Act, the FTC's rule on consumer reviews and testimonials, the Health Breach Notification Rule, the TCPA (texts and calls), and CAN-SPAM (email).
3. State law: consumer health data laws, comprehensive privacy laws, wiretap laws, and mental-health confidentiality statutes. Many of these are stricter than HIPAA.
4. Professional ethics codes and licensing-board rules: APA, ACA, NASW, AAMFT, NBCC (for National Certified Counselors), and your state board. For testimonials and reviews, these are often the strictest layer.

The governing principle: When rules conflict, follow the most protective one. HIPAA sets a federal floor. State laws that are "more stringent" than HIPAA still apply (45 CFR §160.203(b)).

Part 1: The Compliance Landscape at a Glance

Part 2: HIPAA Fundamentals for Marketing

2.1 Is your practice a "covered entity"?

A health care provider who transmits health information electronically in connection with a standard transaction, such as an insurance claim or eligibility check, is a HIPAA covered entity. That includes transactions sent through a billing service or EHR (45 CFR §160.103). Most practices that take insurance are covered.

Cash-pay practices: Even if HIPAA doesn't technically apply, you're still subject to FTC rules, state health-data and privacy laws, state mental-health confidentiality laws, and your ethics code. The FTC's actions against the online therapy companies BetterHelp and Cerebral didn't depend on HIPAA. In practice, every mental health practice should hold its marketing to HIPAA-level standards.

2.2 What counts as PHI in a marketing context

PHI is individually identifiable information about a person's past, present, or future physical or mental health, the care they received, or payment for that care (45 CFR §160.103). In marketing, PHI covers more than people expect:

• The fact that someone is or was your client. Confirming the relationship discloses that the person received care from you. OCR has settled cases against practices that did this in replies to online reviews (see 5.2).
• Client names, emails, and phone numbers on your client list. A list of "people who see this therapist" is itself health information.
• Intake form answers, appointment details, and the reason for the visit.
• Photos, video, voice, or stories that could identify a client, including to their friends or family.
• Website data linking a person to a health service, such as an IP address plus a scheduling request.

2.3 How HIPAA defines "marketing"

Under 45 CFR §164.501, marketing is a communication about a product or service that encourages the recipient to buy or use it. The 2013 Omnibus Rule tightened these rules. It requires authorization for marketing that involves payment from a third party and bans the sale of PHI without authorization (78 Fed. Reg. 5566; 45 CFR §164.508(a)(3)–(4)).

Communications that are not marketing and need no authorization:

• Treatment communications to an existing client, such as recommending a group program, another provider, or a different therapy approach, as long as no third party is paying you to make them.
• Care coordination and case management.
• Face-to-face conversations with the client.
• Promotional gifts of nominal value (45 CFR §164.508(a)(3)(i)).

Uses that require a signed HIPAA authorization:

• Using a client's name, image, story, or quote in any promotion.
• Uploading client emails or phone numbers to Facebook/Meta, Google, or another ad platform, such as "Custom Audiences" or "Customer Match."
• Marketing paid for by a third party whose product or service you're promoting. The authorization must state that payment is involved (45 CFR §164.508(a)(3)(ii)).
• Any sale of PHI (45 CFR §164.502(a)(5)(ii)).

A valid authorization must include (45 CFR §164.508(c)): a specific description of the information; who discloses and who receives it; the purpose; an expiration date or event; the right to revoke and how; a statement about whether treatment is conditioned on signing; a statement that the information may be redisclosed; and the client's signature and date.

2.4 Psychotherapy notes: never a marketing input

Psychotherapy notes are a clinician's separately kept notes analyzing the contents of sessions (45 CFR §164.501). They get the strongest protection HIPAA offers. Most uses and disclosures need a specific authorization, and a provider can't make treatment, payment, enrollment, or eligibility depend on signing it (45 CFR §164.508(a)(2), (b)(3)–(4)). Nothing from psychotherapy notes, or from session content generally, belongs in any marketing workflow.

2.5 Business Associate Agreements (BAAs)

Any vendor that creates, receives, maintains, or transmits PHI for you is a business associate. The vendor must sign a BAA and is directly liable under HIPAA (45 CFR §§160.103, 164.502(e), 164.504(e)). Vendors' terms of service and data practices change, so review them at least once a year, especially for tools that add AI features.

Minimum necessary: Even with a BAA, give a vendor only the PHI it needs for its specific job (45 CFR §164.502(b)).

Part 3: Website Creation

3.1 Tracking technologies

Third-party trackers are nearly everywhere in healthcare. A census of 3,747 U.S. hospital websites found third-party data transfers on 98.6% of homepages, with a median of 16 per homepage (Friedman et al., Health Affairs 2023). Hospitals have reported pixel-related breaches. In 2022, Novant Health notified about 1.36 million people that a Meta pixel on its website may have sent their information to Meta. It later settled the resulting class action for about $6.6 million.

The OCR guidance and where it stands today:

• December 2022 bulletin (updated March 2024): OCR said trackers on logged-in pages, such as patient portals, generally have access to PHI and must comply with HIPAA. It also said that on public pages about specific conditions, sending a visitor's IP address plus the page URL to a vendor could be a PHI disclosure.
• June 2024, American Hospital Association v. Becerra (N.D. Tex.): The court vacated the part of the bulletin treating "IP address + visit to a public, unauthenticated page about a health condition or provider" as PHI on its own. HHS filed an appeal and then withdrew it on August 29, 2024, so that ruling is final. The court did not vacate the bulletin's guidance on logged-in pages or on pages where a visitor books an appointment or otherwise shows they are seeking care.- Lawsuit risk remains regardless: Patients sue under state wiretap and privacy laws, which HIPAA doesn't preempt. Mass General Brigham paid $18.4 million to settle claims over cookies and pixels on its public websites. In 2026, LifeStance Health, a large outpatient mental health provider, agreed to pay about $3.03 million to settle claims that its website and booking tool sent patient information to Meta and Google. It also agreed to stop using non-HIPAA-compliant tracking tools for five years (Strong v. LifeStance Health Group, D. Ariz.).
• FTC precedent specific to mental health: The FTC alleged that BetterHelp shared sensitive mental health data with advertising platforms despite promising privacy. The 2023 order required $7.8 million for consumer refunds and banned BetterHelp from sharing health data for advertising. In 2024 the FTC reached orders with Cerebral (about $7 million, plus a ban on using health data for most advertising) and Monument, an alcohol use disorder treatment service (a ban on sharing health data for advertising without consent), over pixel-based sharing. In 2023, GoodRx became the first company the FTC charged under the Health Breach Notification Rule.

Practical rules for therapist websites:

1. No advertising pixels (Meta, TikTok, LinkedIn Insight, X, Pinterest) on booking pages, intake forms, contact forms, portals, "thank you" or confirmation pages, or chat.
2. Our recommendation: Leave advertising pixels off the whole site, including condition pages like "Anxiety Therapy" or "Trauma/EMDR." AHA v. Becerra narrowed OCR's position on public pages, but state wiretap claims and FTC enforcement don't depend on that guidance. For a mental health practice, the legal and reputational risk outweighs the targeting benefit.
3. Analytics: Use a HIPAA-eligible analytics tool that signs a BAA, or server-side tagging that strips IP addresses and identifiers before data reaches a third party. If you keep standard Google Analytics, remove it from all sensitive flows and confirm no form fields, URLs, or query strings contain health details.
4. Session replay and heatmap tools (which record keystrokes and clicks) don't belong on any page with forms.
5. Embedded third-party widgets (YouTube, Google Maps, Calendly-type tools, social feeds) can drop trackers too. Audit them.
6. Audit the site quarterly with a tag-scanning tool. Plugins and theme updates often re-add trackers.

3.2 Forms, scheduling, and contact pages

• Contact forms: Collect only name, preferred contact method, and a callback time. Add a visible notice, for example: "Please don't include clinical details in this form. We'll discuss your needs privately."
• Intake and scheduling: Route these to a HIPAA-compliant platform covered by a BAA, not a generic form builder that emails results to a Gmail inbox.
• Use encryption: HTTPS across the whole site, encrypted form submissions, and multi-factor authentication on every admin account (our recommendation; see 7.1).
• Keep health details out of URLs: Use neutral confirmation pages like "/thank-you," not "/depression-consult-booked."

3.3 Required and recommended website notices

3.4 Accessibility

A professional office of a health care provider is a public accommodation under ADA Title III, regardless of size (42 U.S.C. §12181(7)(F)). DOJ hasn't adopted a technical web standard for Title III, but it treats inaccessible websites as a potential violation. HHS's 2024 Section 504 rule adopts WCAG 2.1 AA for websites and mobile apps of practices that receive HHS financial assistance (for example, Medicaid). It also covers content provided through vendors, such as portals and schedulers (45 CFR Part 84, Subpart I). An interim final rule issued May 7, 2026 extended the compliance dates by one year: May 11, 2027 for recipients with 15 or more employees and May 10, 2028 for those with fewer than 15. The duty to make reasonable modifications for people with disabilities applies now. Our recommendation: Build every site to WCAG 2.1 AA.

3.5 Website build checklist

• HIPAA-ready hosting with SSL; BAA where the host stores form data
• No ad pixels on any form, booking, portal, chat, or confirmation page (our recommendation: none site-wide)
• Analytics are BAA-covered or de-identified; IP anonymization; no PHI in URLs
• Contact form limited to minimum data, with a "no clinical details" notice
• Intake and scheduling on a BAA-covered platform
• Notice of Privacy Practices, accurate privacy policy, and Washington-style consumer health data policy
• Consent banner configured to block tags until consent
• Crisis disclaimer and license information
• WCAG 2.1 AA accessibility audit
• Quarterly tag and tracker audit, documented

Part 4: Creating Content for Your Audience

4.1 Accuracy and credentials

The major mental health ethics codes prohibit false or misleading claims. Under APA Ethical Standard 5.01, psychologists don't make false, deceptive, or fraudulent statements about their training, experience, competence, credentials, services, or fees. The ACA Code (Standard C.3) requires counselors to advertise accurately. AAMFT Standard 9.1 requires marriage and family therapists to accurately represent their licensure, degrees, competencies, and training. NBCC Provision 2 requires National Certified Counselors to accurately represent their current qualifications and credentials.

What this means for content:

• Don't promise outcomes ("Cure your anxiety in 6 sessions"), and don't use "guaranteed."
• List only credentials, specialties, and certifications you actually hold. Be careful with "specialist" or "expert," since some boards restrict these words.
• Back up any effectiveness claims about a method (e.g., EMDR, DBT) with evidence, and don't overstate them.
• Advertise only in states where you're licensed, or state your licensure clearly. Telehealth marketing to other states can imply unlicensed practice.

4.2 Educational content (blogs, videos, social posts)

General education about conditions, coping strategies, and therapy approaches is low-risk and encouraged. Guardrails:

• No real client stories without written authorization, and even then think carefully (see 4.3).
• Composite or fictional vignettes: Label them clearly ("This is a composite example; details are fictional"). Change enough details that no client, or anyone who knows them, could recognize the situation. Recognition by friends or family is a real risk. In one study of 754 posts in which health professionals shared stories about patients on Twitter, researchers judged that friends or family could likely identify the clinical scenario in 32.1% of them (Ahmed et al., Journal of Medical Internet Research 2020).
• Test it: Post only what could ethically appear in a newspaper or journal, even in "private" groups.
• Avoid "a client told me today…" posts. The timing, location, or detail can identify the person.
• Separate education from therapy. Add a disclaimer that content isn't a substitute for treatment and doesn't create a therapeutic relationship.

4.3 Testimonials: the strictest area for therapists

Why this is stricter for therapists: Most of the codes single out people "vulnerable to undue influence," and NBCC sets a fixed five-year window for former clients. They do this because the therapy relationship carries a power imbalance, which makes it hard to know whether a client's consent is truly voluntary. Online content is also effectively permanent, so clients should understand that before agreeing to anything.

Our recommendation: Don't use client testimonials. Use alternatives:

• Professional endorsements from colleagues or referral sources (no client information)
• Your credentials, training, approach, and values
• Aggregate, de-identified outcome data, where valid
• Explainer videos of you describing what a first session is like

4.4 Social media conduct

The APA Ethics Code doesn't directly address social media, which leaves room for interpretation. The Association of State and Provincial Psychology Boards (ASPPB) adopted social media guidelines in 2020 after surveying its member boards about complaints and concerns involving psychologists' use of technology. Confidentiality, boundaries, and informed consent are central themes (Drude and Messer-Engel, Journal of Technology in Behavioral Science 2020). The NASW Code of Ethics says social workers should avoid posting identifying or confidential client information on professional websites or other social media (Standard 1.07(r)). It also says they should develop, and tell clients about, their policies on using electronic technology, including internet search engines, to gather information about clients (Standard 1.07(p)).

Rules for practice social media:

1. Have a written social media policy and include it in informed consent. Psychologist Keely Kolmes publishes a model policy that many clinicians adapt.
2. Don't friend or follow clients from professional or personal accounts, and don't accept their requests.
3. Never confirm a client relationship in comments, likes, replies, or tags. If a client comments "Thanks for helping me through my divorce!", don't reply, and consider hiding the comment.
4. Don't do therapy in direct messages. Move clients to secure channels using a standard reply that doesn't confirm or discuss treatment.
5. Photos and video: Make sure nothing identifiable is visible, such as the waiting room, the schedule, screens, files, or people in the background. Turn off real-time location tagging.
6. Keep personal and professional accounts separate, and lock down privacy settings on personal accounts.
7. Hashtags and targeting: Don't use phrasing that could suggest you're addressing a specific person.

4.5 AI-generated content

AI writing tools are fine for general educational content, but:

• Never paste client information into a consumer AI tool (e.g., free ChatGPT or Gemini). Those tools don't sign BAAs, so you'd be disclosing PHI to a vendor with no HIPAA obligations to you. Scholars have also noted that general-purpose chatbots raise privacy problems HIPAA wasn't designed for (Marks and Haupt, JAMA 2023).
• Review AI content for clinical accuracy and overstated claims. You're responsible for anything published under your name (APA Standard 5.01).
• Several states now regulate AI in mental health care and patient communications, including Illinois, Nevada, Utah, Texas, and California. See Part 9.

Part 5: Responding to Online Reviews

5.1 Why reviews are a common trap

HIPAA doesn't stop clients from writing about their own care. It does stop you from adding to what they said. A response that confirms the reviewer was a client, or mentions their care, discloses PHI, even if the client posted about it first. OCR's position is direct: "Providers cannot disclose protected health information of their patients when responding to negative online reviews" (OCR Director Melanie Fontes Rainer, December 2022). Our recommendation is never to argue with a negative review in public.

This part covers the compliance rules. For a longer walkthrough with more response examples, see our guide to responding to online reviews.

5.2 OCR enforcement examples

Each of these comes from an HHS Office for Civil Rights resolution agreement or penalty notice. The first four involved online reviews; the last two involved other public or marketing disclosures.

Responses to online reviews

Other public or marketing disclosures

Takeaway: A mental health practice has already paid an OCR settlement over a review response. Corrective action plans in these cases typically ran two years and required rewritten policies and staff training.

5.3 Review response rules

Do:

• Respond generically or not at all. Silence never discloses PHI.
• Use one pre-approved template for every review, positive or negative, so the pattern itself doesn't confirm anything.
• Invite offline contact through a general practice line.
• If you can tell who wrote it, consider reaching out privately through normal clinical channels to resolve the concern. Consult counsel first if it's contentious.
• Get positive reviews through passive means (see 5.4).

Don't:

• Confirm or deny that the person is or was a client. "We're sorry your sessions didn't help…" confirms the relationship.
• Correct the facts, explain clinical decisions, or mention dates, diagnoses, insurance, missed appointments, or billing disputes.
• Thank a positive reviewer for "being our client" or mention their progress.
• Reply out of anger or on the same day. Use a 48-hour cooling-off rule.
• Let staff or an agency reply without an approved template.

Approved response templates:

Negative or neutral review:

"Thank you for taking the time to share feedback. Because of privacy laws and professional ethics, we can't confirm or discuss whether anyone is or was a client of our practice. We take all feedback seriously and invite anyone with concerns to contact our practice manager directly at phone."

Positive review:

"Thank you for your kind words. Our practice is committed to providing compassionate, confidential care to our community." (Don't confirm the relationship, and don't use the reviewer's name.)

Review that seems fake or not about your practice:

Don't reply with "we have no record of you," which is itself a statement about your records. Report it to the platform under its policies instead.

5.4 Asking for reviews: ethics, FTC rules, and platform rules

Our recommendation: Don't directly ask current clients for reviews. Acceptable passive options include a neutral "Find us on Google" link on the website or in email signatures, a profile link in general newsletters that go to everyone, and reviews from professional colleagues on directories that allow them. Never offer discounts, gifts, or session credits for reviews.

5.5 Removing or disputing reviews

Flag reviews that violate platform policy (e.g., fake, off-topic, hate speech). Platforms rarely remove subjective negative reviews. Ask for removal only of content that is factually false or breaks platform policy, not accurate negative feedback. Defamation suits against clients are costly, hard to win, and tend to draw more attention to the review. Never threaten a reviewer with legal action. Under the FTC rule, using unfounded legal threats to prevent or remove a review is prohibited review suppression (16 CFR §465.7).

Part 6: Paid Advertising, Retargeting, and Audience Targeting

Part 7: Email, Text Messaging, and Phone

7.1 Communications with existing clients (HIPAA)

• Encryption of PHI in transit is an "addressable" Security Rule standard today: you must implement it or document why an equivalent alternative is reasonable (45 CFR §164.312(e)). A proposed Security Rule update published January 6, 2025 would make encryption and multi-factor authentication mandatory. HHS now lists July 2027 as its target for final action, and until then the current rule applies.
• HHS guidance allows providers to send unencrypted email to a client who prefers it, after warning the client about the risks. Document that choice.
• Standard SMS isn't encrypted end to end. Use a healthcare messaging platform that signs a BAA. Keep reminders minimal, e.g., "Reminder: appointment tomorrow at 3 pm with Practice Name. Reply C to confirm." Don't name the service type or clinician specialty if you can avoid it.
• Newsletters to clients: Your client list is PHI, so use an email platform covered by a BAA. Never put multiple clients in the "To" or "CC" field. Use BCC or a platform that sends individually. Newsletters about your own services generally count as treatment or operations communications. Promoting a third party's product in exchange for payment requires authorization (45 CFR §164.508(a)(3)(ii)).

7.2 TCPA (texts and calls)

• Appointment reminders and other care-related texts from a HIPAA covered entity need prior express consent, not written consent, which a client generally gives by providing their number for that purpose. FCC rules add limits on frequency and content for some of these messages. Every message should offer an opt-out (e.g., "Reply STOP").
• Opt-outs: Since April 11, 2025, FCC rules require honoring a revocation made by any reasonable means (a "stop" reply, an email, a phone request) within 10 business days (47 CFR §64.1200).
• Marketing texts (promotions, new groups, workshops sent to prospects) sent with an autodialer or prerecorded voice need prior express written consent (47 CFR §64.1200(a)(2)).
• Statutory damages are $500 per message, up to $1,500 if willful or knowing, and recipients can sue directly (47 U.S.C. §227(b)(3)).
• Federal rules limit telephone solicitations to 8 am–9 pm in the recipient's time zone (47 CFR §64.1200(c)(1)). Florida, Oklahoma, and Maryland have "mini-TCPA" laws with private lawsuits, an 8 pm cutoff, and limits on how often you can contact the same person. Washington also ends the calling day at 8 pm and restricts commercial texts.

7.3 CAN-SPAM (commercial email)

Commercial email needs accurate "From" and header information, an honest subject line, identification as an advertisement where applicable, your physical postal address, and a clear opt-out honored within 10 business days (15 U.S.C. §7704; 16 CFR Part 316). CAN-SPAM uses an opt-out model, but HIPAA and ethics rules still govern whether you can email clients at all.

Part 8: AI Tools, Chatbots, Call Tracking, and Emerging Technology

• AI chatbots on your website: If a chatbot takes intake details or symptoms, it collects PHI. It needs a BAA, encryption, and clear disclosure that it's automated. Several states now regulate chatbots that discuss mental health (see Part 9). Our recommendation: Contracts with any AI vendor should also limit data retention and bar training models on client data.
• AI scribes and note tools: Need a BAA and the client's informed consent to recording. Confirm the vendor doesn't use your data to train models. The 2026 AAMFT Code requires written authorization before using transcription services (Standard 1.11), and Illinois requires written consent before AI is used with recorded or transcribed sessions.
• AI receptionists and voice agents: Same as chatbots, plus all-party-consent recording laws (see below).
• Call tracking and recording: Recording calls requires consent from everyone on the call in all-party-consent states, including California (Penal Code §632) and Illinois (720 ILCS 5/14-2). Call-tracking vendors that record, transcribe, or link calls to marketing sources need BAAs, and call data must stay out of ad platforms.
• Biometrics: Facial recognition check-in or voice analysis triggers Illinois's Biometric Information Privacy Act. It requires written consent before collection, and people can sue for $1,000 per negligent violation or $5,000 per intentional or reckless violation (740 ILCS 14/15, 14/20). A 2024 amendment limits recovery to one award per person for repeated collection by the same method.

Part 9: State Law Spotlight

HIPAA is the floor. These states add the most significant requirements for mental health marketing. State law changes often, so each entry gives the dates we confirmed as of October 28, 2026.

Washington

My Health My Data Act (RCW 19.373; in effect since March 31, 2024, and since June 30, 2024 for small businesses)

• Covers "consumer health data," including mental health information and website or app data, beyond HIPAA's scope. PHI already governed by HIPAA is exempt, but marketing and website data often isn't PHI.
• Requires separate consent to collect and to share, plus a signed authorization for any sale.
• Requires a consumer health data privacy policy linked from the homepage.
• Bans geofencing within 2,000 feet of in-person health care facilities.
• Allows private lawsuits through the state Consumer Protection Act. Small businesses are covered too.
• Washington also has stricter calling hours than federal law (see 7.2).

California

Confidentiality of Medical Information Act (CMIA), CCPA/CPRA, the California Invasion of Privacy Act (CIPA), and AI-disclosure laws

• The CMIA bars disclosing medical information without authorization (Civil Code §56 et seq.).
• The CCPA treats health data as "sensitive personal information," and IP addresses can be personal information (Civil Code §1798.140). Many CCPA duties apply only above revenue or volume thresholds that many solo practices don't meet.
• CIPA remains a major lawsuit risk for pixels, chat widgets, and session replay. SB 690, signed September 30, 2026, takes effect January 1, 2027. From then on, only the attorney general can sue under CIPA's pen-register and trap-and-trace provision (Penal Code §638.51) over website or app tracking. The change also applies to pending claims in cases filed on or after January 1, 2025. Private plaintiffs can still sue under the wiretapping (§631) and recording (§632) provisions.
• AB 3030 (Health & Safety Code §1339.75, effective January 1, 2025) requires clinics, physician offices, and group practices that use generative AI for clinical patient communications to disclose it, unless a licensed provider reviews the message first.
• AB 489 (effective January 1, 2026) bars AI systems from implying they're licensed health professionals.
• Board of Behavioral Sciences licensees must include license type and number in advertising (16 CCR §1811).

Nevada

SB 370 (consumer health data) and AB 406 (AI in mental health care)

• SB 370 is similar to Washington's law: it requires consent and a privacy policy and bans geofencing within 1,750 feet of health care facilities. The attorney general enforces it, and there are no private lawsuits.
• AB 406 (effective July 1, 2025) bars AI providers from offering AI programmed to provide mental or behavioral health care, or claiming it can.
• AB 406 also bars licensed providers from using AI to provide care directly to patients. AI is allowed only for administrative support, and the provider must review its output.

Connecticut

Consumer health data amendments to the Connecticut Data Privacy Act

• Consent is required to process or sell consumer health data.
• Geofencing within 1,750 feet of mental health or reproductive or sexual health facilities is banned.
• The health-data provisions apply regardless of business size. HIPAA-covered PHI is exempt.

New York

Mental Hygiene Law §33.13 and the NY Health Information Privacy Act (pending)

• New York already has strong confidentiality protections for mental health records.
• The Legislature passed the Health Information Privacy Act in January 2025, and Governor Hochul vetoed it on December 19, 2025.
• A revised version (S.9269/A.10357) passed the Senate on June 3, 2026 and the Assembly on June 4, 2026. As of October 28, 2026, the Senate's bill record showed no signature or veto. If enacted, it would sharply limit processing of health data without authorization.
• New York also restricts geofenced advertising at health care facilities.

Texas

Texas Medical Records Privacy Act (HB 300), Texas Data Privacy and Security Act, and AI-disclosure laws

• Chapter 181 of the Health and Safety Code defines "covered entity" more broadly than HIPAA, requires employee privacy training within 90 days of hire (§181.101), and restricts the sale and electronic disclosure of PHI.
• The Texas Data Privacy and Security Act (in effect since July 1, 2024) requires opt-in consent for sensitive data, including health data. Small businesses are largely exempt, but they still need consent before selling sensitive data.
• SB 1188 (effective September 1, 2025) requires practitioners who use AI for diagnostic purposes to disclose that to patients.
• HB 149, the Texas Responsible AI Governance Act (effective January 1, 2026), requires providers to disclose AI use in a health care service or treatment.

Illinois

Biometric Information Privacy Act (BIPA), all-party-consent eavesdropping law, and the Wellness and Oversight for Psychological Resources Act

• BIPA's private lawsuits drive large class actions (see Part 8).
• Recording calls requires all-party consent (720 ILCS 5/14-2).
• The Wellness and Oversight for Psychological Resources Act (Public Act 104-0054, in effect since August 2025) bars anyone from offering therapy through AI.
• Licensed professionals may use AI only for administrative and supplementary support. Using AI with recorded or transcribed sessions requires the client's written consent.
• Violations can bring civil penalties of up to $10,000 each.

Utah

HB 452 (mental health chatbots, in effect since May 7, 2025)

• Suppliers of AI mental health chatbots must disclose that the chatbot is AI and not a human.
• They may not sell or share users' health information or inputs, and they face limits on advertising.
• Penalties are up to $2,500 per violation.
• Our recommendation: Never market an AI tool as therapy, in any state.

Maryland

Maryland Online Data Privacy Act (in effect October 1, 2025; applies to processing from April 1, 2026) and the Stop the Spam Calls Act

• Bans the sale of sensitive data, including consumer health data, even with consent.
• Allows collection of sensitive data only when strictly necessary.
• Bans geofencing within 1,750 feet of mental health, reproductive, or sexual health facilities.
• Maryland's mini-TCPA (in effect since January 1, 2024) allows private lawsuits (see 7.2).

Florida and Oklahoma

State mini-TCPA laws

• Both set stricter calling hours and contact limits than federal law, and both allow private lawsuits (see 7.2).

All states

Mental-health confidentiality statutes and therapist-patient privilege

• Every state has its own mental-health confidentiality rules, and how they apply to digital communication is often unclear.
• Rules on minors' records also vary widely.

About 20 states with comprehensive privacy laws

For example, Virginia, Colorado, Oregon, Montana, Delaware, New Jersey, and Minnesota

• Most exempt HIPAA PHI and have volume thresholds that solo practices may not meet.
• Website and marketing data outside HIPAA may still be covered, and many of these laws treat mental health data as "sensitive data" that requires opt-in consent.

Part 10: Special Situations

• Substance use disorder services (42 CFR Part 2): Rules are stricter than HIPAA. The 2024 final rule moved Part 2 closer to HIPAA, for example by allowing a single consent for treatment, payment, and health care operations, while keeping extra protections (89 Fed. Reg. 12472). The compliance date was February 16, 2026, and OCR now accepts Part 2 complaints and breach reports. Never use SUD client information in marketing, and keep SUD-specific pages pixel-free. The FTC's orders against Cerebral and Monument show its focus on SUD data.
• Minors and families: Consent for testimonials, photos, and communications is complicated by state minor-consent and parental-access laws. Never feature minors who are or were clients.
• Couples and family therapy: One family member's review or comment can expose others' information. The same no-confirmation rule applies.
• Group practices: Every clinician's personal social media is a liability if they post about work. Adopt a practice-wide social media policy and train on it.
• Interstate telehealth marketing: Advertise only where you're licensed, or under recognized compacts such as PSYPACT or the Counseling Compact, and say so in ads.
• Reproductive health privacy: A federal court vacated nearly all of the 2024 HIPAA reproductive health privacy amendments nationwide on June 18, 2025 (Purl v. HHS, N.D. Tex.). State laws on reproductive and gender-affirming care data (e.g., California, Washington) still apply to related mental health services.

Part 11: Operational Safeguards Every Practice Needs

1. Security risk analysis: HIPAA requires one, with periodic review and updates (45 CFR §164.308(a)(1)(ii)(A)). Include marketing technology: website, forms, email platforms, and AI tools. Our recommendation: Repeat it at least yearly.
2. Written policies for social media, review responses, marketing authorizations, vendor management, and the website tracker inventory.
3. BAA inventory: A list of every vendor, whether it touches PHI, and BAA status, reviewed yearly.
4. Training: All clinicians, staff, and agency personnel, documented. Texas requires employee privacy training within 90 days of hire.
5. Breach response plan: If PHI is disclosed improperly (pixel leak, misdirected email, review response), HIPAA requires notifying affected individuals without unreasonable delay and within 60 days of discovery. Breaches affecting 500 or more people require notice to HHS at the same time, and breaches affecting more than 500 residents of a state also require notice to prominent media there. Smaller breaches are logged and reported to HHS within 60 days after the end of the calendar year (45 CFR §§164.404–164.408). State laws may set shorter deadlines. If a vendor has a breach, confirm who handles notifications under the BAA.
6. Penalties: HIPAA civil penalties are tiered by culpability. The calendar-year cap for violations of an identical provision is $2,190,294 (2025 inflation-adjusted amount, applied by HHS in January 2026 and unchanged for 2026), and OCR applies lower caps for lesser culpability. Knowingly obtaining or disclosing PHI with intent to sell it or use it for commercial advantage can bring criminal penalties of up to $250,000 and 10 years in prison (42 U.S.C. §1320d-6). Ethics violations can cost you your license, which is often the bigger threat for a solo clinician.

Part 12: Master Compliance Checklist

Website

• No ad pixels on forms, booking, portal, chat, or confirmation pages (our recommendation: none site-wide)
• BAA-covered or de-identified analytics; no PHI in URLs
• HIPAA-compliant intake and scheduling with a BAA
• Notice of Privacy Practices, accurate privacy policy, consumer health data policy (WA/NV/CT)
• Consent banner that blocks tags until consent
• Crisis disclaimer; license type and number
• WCAG 2.1 AA accessibility
• Quarterly tracker audit, documented

Content and social

• No identifiable client information; composite vignettes clearly labeled
• No solicited client testimonials
• Credentials and claims accurate; no outcome guarantees
• Written social media policy in informed consent
• No friending, following, or engaging with clients; no clinical DMs
• No client data in consumer AI tools

Reviews

• Approved generic templates only; never confirm a client relationship
• No direct asking of current clients; no incentives; no review gating
• Policy-violating reviews reported; no threats

Advertising

• No client-list uploads, retargeting pixels, or condition-based targeting
• No geofencing near health facilities
• Landing pages pixel-free or BAA-covered

Email and SMS

• BAA-covered platforms for client communications
• Prior express written consent for marketing texts; opt-outs honored within 10 business days
• CAN-SPAM elements in all commercial email; BCC or individual sends only

Vendors and operations

• BAA inventory current (including any marketing agency that accesses PHI)
• Annual security risk analysis covers marketing technology
• Staff and agency training documented
• Breach response plan tested

Sources

Federal law and agency actions

• HIPAA Administrative Simplification regulations, 45 CFR Parts 160 and 164 (definitions, marketing, authorizations, psychotherapy notes, business associates, breach notification).
• HHS OCR, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates
• American Bar Association, HHS Voluntarily Dismisses Appeal in Online Tracking Technology Lawsuit (AHA v. Becerra), September 2024
• HHS OCR, Manasa Health Center resolution agreement (2023)
• HHS OCR, New Vision Dental resolution agreement (2022)
• HHS, Four HIPAA enforcement actions including Northcutt Dental and Dr. U. Phillip Igbinadolor (March 28, 2022)
• HHS OCR, Elite Dental Associates resolution agreement (2019)
• HHS OCR, Allergy Associates of Hartford resolution agreement (2018)
• HIPAA Journal, HHS applies inflation increase to HIPAA penalties (January 2026)
• Fierce Healthcare, HIPAA Security Rule overhaul pushed to July 2027
• HHS, Part 2 (substance use disorder records)
• Holland & Knight, HIPAA's Reproductive Health Rule Is Vacated Nationally (Purl v. HHS), June 2025
• Federal Register, HHS Section 504 web and mobile accessibility compliance date extension (May 2026)
• Federal Register, FTC Trade Regulation Rule on the Use of Consumer Reviews and Testimonials (August 22, 2024)
• Federal Register, FTC Civil Penalty Inflation Adjustments (September 15, 2026)
• FTC, BetterHelp order (March 2023)
• Wilson Sonsini, FTC proposed orders with Cerebral and Monument (2024)
• Privacy World, FCC consent-revocation rules effective April 11, 2025
• TCPA, 47 U.S.C. §227 and 47 CFR §64.1200; CAN-SPAM, 15 U.S.C. §7704 and 16 CFR Part 316; ADA Title III, 42 U.S.C. §12181; HIPAA criminal penalties, 42 U.S.C. §1320d-6.

State law

• Washington My Health My Data Act, RCW 19.373
• Covington (Inside Privacy), California Governor Signs SB 690, October 5, 2026
• Pillsbury, Governor Newsom Signs SB 690, October 5, 2026
• California AB 489 (2025), chaptered text
• California Board of Behavioral Sciences, advertising examples for licensees
• Nevada AB 406 (2025), enrolled text
• McDermott Will & Emery, Nevada and Connecticut pass consumer health data laws (2023)
• Orrick, The Consumer Health Data Amendments to the Connecticut Data Privacy Act
• HIPAA Journal, Governor Hochul vetoes New York Health Information Privacy Act
• New York State Senate, S.9269 (2026) bill status
• Texas Medical Association, AI disclosure requirements under SB 1188 and HB 149
• Texas Optometry Board summary of HB 300 training requirements
• Illinois Public Act 104-0054 (Wellness and Oversight for Psychological Resources Act)
• WilmerHale, Illinois legislature modifies BIPA damages rule (SB 2979)
• Utah HB 452 (2025)
• Baker Donelson, Maryland Online Data Privacy Act
• Goodwin, Mini-TCPA laws you should know

Ethics codes and professional guidance

• APA Ethical Principles of Psychologists and Code of Conduct, Standards 5.01 and 5.05.
• ACA Code of Ethics (2014), Standard C.3. ACA's ethics page lists the 2014 code as current pending adoption of a revision.
• NBCC Code of Ethics (approved May 2023, revised August 2023), Provisions 2 and 9.
• NASW Code of Ethics, Standards 1.07(p), 1.07(r), and 4.07(b).
• AAMFT Code of Ethics (effective January 1, 2026)
• Drude and Messer-Engel, The Development of Social Media Guidelines for Psychologists and for Regulatory Use, J Technol Behav Sci 2020

Research and litigation

• Friedman et al., Widespread Third-Party Tracking on Hospital Websites, Health Affairs 2023
• McCoy et al., User Information Sharing and Hospital Website Privacy Policies, JAMA Network Open 2024
• Ahmed et al., Public Disclosure on Social Media of Identifiable Patient Information by Health Professionals, J Med Internet Res 2020
• Marks and Haupt, AI Chatbots, Health Privacy, and Challenges to HIPAA Compliance, JAMA 2023.
• HIPAA Journal, Mass General Brigham settles cookies-without-consent lawsuit for $18.4 million
• Behavioral Health Business, LifeStance reaches settlement in data privacy lawsuit (August 2026)

This guide summarizes federal and state requirements, professional ethics standards, and published research as of October 2026. Where a rule is pending or in litigation, we note its status and the date we checked. Confirm with qualified legal counsel and your state licensing board before relying on any of it.